Wizard Spider turned a banking trojan into one of the most productive ransomware supply chains ever documented, and the access methods it industrialised are still the ones most enterprises fail to close. MITRE ATT&CK tracks the group as G0102 and its founding malware, TrickBot, as S0266. This profile follows the group's tooling lineage from Dyre to TrickBot, Bazar, Anchor and the ransomware families it ran, the disruption and sanctions actions against it, and the detections that catch its tradecraft at the loader stage, before anyone reaches a domain controller. It draws on ATT&CK v20, CISA alert AA21-076A, Microsoft, IBM X-Force, the US Treasury and Europol. It is for threat intelligence analysts, SOC teams and incident responders. The Conti ransomware operation and its leaked playbook have their own profile: see the Conti Ransomware Profile Guide; this page covers the operator group behind it and does not repeat that material.
Key takeaways
- A group defined by its loaders. ATT&CK describes Wizard Spider as a Russia-based, financially motivated group known for creating and deploying TrickBot since at least 2016, and links it to Bazar, Anchor, Ryuk, Conti, Diavol and SystemBC.
- The commodity infection was the real incident. Microsoft observed TrickBot acting as the entry point for human-operated attacks, with persistence left behind for later ransomware delivery, so a "cleaned" TrickBot alert was often the start of a longer intrusion.
- Credentials were the product. TrickBot modules harvested browser, RDP, VPN, SSH, PuTTY, KeePass and email credentials, and the operators then went after Domain Admin through Kerberoasting, LSASS dumping and NTDS theft.
- Disruption slowed it but did not end it. US Cyber Command and a Microsoft court order hit TrickBot infrastructure in late 2020, yet IBM X-Force reported the gang had pivoted and was still expanding distribution through affiliates in 2021.
- Names overlap across vendors. ATT&CK v20 maps UNC1878, Grim Spider, FIN12, GOLD BLACKBURN, ITG23, Periwinkle Tempest, DEV-0193, Pistachio Tempest and DEV-0237 to the group, so check alias mappings before you merge or split intelligence.
Who they are (names and aliases)
Wizard Spider is best understood as a cluster of developers, operators and affiliates rather than one tidy organisation. Microsoft, for example, tracked the developer nexus as DEV-0193 ("Trickbot LLC") and a prolific ransomware affiliate separately as DEV-0237, while ATT&CK v20 folds both into G0102. This page names no individuals; group-level attribution below comes from ATT&CK, government statements and vendor primary research.
| Tracker | Name used | What it usually refers to |
|---|---|---|
| MITRE ATT&CK | Wizard Spider (G0102) | The whole cluster, with aliases UNC1878, TEMP.MixMaster, Grim Spider, FIN12, GOLD BLACKBURN, ITG23, Periwinkle Tempest, DEV-0193, Pistachio Tempest, DEV-0237 |
| Microsoft (2022 naming) | DEV-0193 | Develops, distributes and manages TrickBot, BazaLoader and AnchorDNS; ran the Ryuk programme until June 2021; linked to Conti and Diavol |
| Microsoft (2022 naming) | DEV-0237 | An affiliate that deployed Ryuk and Conti, then moved to other ransomware payloads |
| IBM X-Force | ITG23 ("TrickBot Gang") | The TrickBot, BazarLoader and Conti operation and its distribution affiliates |
| US Treasury | Trickbot Group | The criminal group sanctioned with the UK in February and September 2023 |
Treasury states that current Trickbot Group members are associated with Russian Intelligence Services and that its 2020 activity aligned with Russian state objectives. Treat that as a government assessment, not a reason to reclassify the group as state-sponsored in your own models: its documented motive remains financial.
The TrickBot lineage
The group's history is a sequence of tools, each built on the access the last one provided. Every family below has its own ATT&CK software entry, which is the most stable reference for detection mapping.
| Family (ATT&CK) | Role | First seen or active (per source) | Defender note |
|---|---|---|---|
| Dyre (S0024) | Banking trojan, TrickBot's predecessor | Treasury: targeting non-Russian businesses from mid-2014 | Historic; relevant only for lineage |
| TrickBot (S0266) | Modular banking trojan turned access and credential platform | ATT&CK: September 2016 | Modules for credential theft, SMB spreading, RDP brute force, VNC and firmware inspection |
| Anchor (S0504) | Backdoor family, including a DNS variant, used with TrickBot on selected high-value targets | ATT&CK: at least 2018 | DNS tunnelling for C2; watch for unusual TXT and long subdomain queries |
| Ryuk (S0446) | Enterprise ransomware | ATT&CK: at least 2018; Microsoft: programme shut down June 2021 | Typically deployed after TrickBot or Bazar access |
| Bazar (S0534) | Downloader and backdoor (BazarLoader, KEGTAP, Team9) | ATT&CK: at least April 2020 | Loader that replaced TrickBot in many campaigns; also delivered Conti and Diavol |
| Conti (S0575) | Ransomware-as-a-service | ATT&CK: December 2019; Microsoft: no deployments seen after 19 April 2022 | See the Conti profile for the playbook and successors |
| Diavol (S0659) | Ransomware programme managed by Wizard Spider, deployed by Bazar | ATT&CK: June 2021 | Same delivery chain as Conti |
| SystemBC (S9001) | Proxy and C2 malware sold as a service | ATT&CK: used by Wizard Spider since at least 2020 | SOCKS5 tunnels from servers are a high-value hunt |
Two features of this lineage matter for defenders. First, distribution was outsourced: IBM X-Force described the gang partnering from mid-2021 with affiliates it tracks as Hive0106 (TA551) and Hive0107, which added hijacked email threads and abused website contact forms, alongside "BazarCall" fake call centre lures from February 2021. Second, Microsoft reported that DEV-0193 hired developers from the Emotet, QakBot and IcedID operations, which is why those families appear in the same intrusions. See the Emotet Malware Guide and the QakBot Malware Guide.
Targeting and motivation
- Banking fraud first: ATT&CK records TrickBot initially targeting banking sites in North America, Australia and Europe, using web injects and browser redirection (T1185) to capture logins.
- Big game hunting: the same access was then sold or used for ransomware against "all sectors worldwide", in ATT&CK's words. Bazar infections were concentrated in professional services, healthcare, manufacturing, IT, logistics and travel in the US and Europe.
- Healthcare under pressure: Treasury describes 2020 ransomware attacks on US hospitals during the pandemic, including one that disrupted the networks and phones of three Minnesota medical facilities and diverted ambulances.
- Election-season risk: Microsoft justified its October 2020 legal action partly on the risk that ransomware could hit systems maintaining voter rolls or reporting results.
Lures followed the news. Microsoft saw COVID-19 and Black Lives Matter themes, and CISA described fake traffic violation notices that led victims to a JavaScript download. A topical lure is not a reason to lower the severity of a loader alert.
Tactics and techniques (MITRE ATT&CK)
The table combines the G0102 group entry and the S0266 software entry in ATT&CK v20, focusing on the stages before encryption where defenders have the most time. All IDs were checked against the v20 dataset. Impact techniques (T1489 Service Stop, T1490 Inhibit System Recovery, T1486 Data Encrypted for Impact) are covered in the Conti profile.
| Stage | Technique | Recorded behaviour |
|---|---|---|
| Initial access | T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link; T1133 External Remote Services | Macro documents and PDFs, links to Google Drive and other free hosting, stolen VPN credentials |
| Execution | T1204.002 Malicious File; T1059.001 PowerShell | Macros launching PowerShell to download TrickBot or Bazar |
| Persistence | T1053.005 Scheduled Task; T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder | Tasks with names imitating legitimate software, autostart services, Run keys |
| Stealth and evasion | T1055.012 Process Hollowing; T1685 Disable or Modify Tools; T1112 Modify Registry | Injection into svchost.exe, disabling Windows Defender, enabling WDigest to expose cleartext passwords |
| Credential access | T1555.003 Credentials from Web Browsers; T1552.001 Credentials In Files; T1552.002 Credentials in Registry; T1056.004 Credential API Hooking; T1110.004 Credential Stuffing | Browser, Outlook, FileZilla, OpenSSH, OpenVPN and PuTTY secrets; RDP credential capture; rdpscanDll brute forcing exposed RDP |
| Privilege escalation in the domain | T1558.003 Kerberoasting; T1003.001 LSASS Memory; T1003.003 NTDS; T1552.006 Group Policy Preferences; T1550.002 Pass the Hash | Rubeus and Invoke-Kerberoast, Mimikatz and LaZagne, ntds.dit copies, GPP password searches |
| Discovery | T1482 Domain Trust Discovery; T1087.002 Domain Account | Nltest for trusts, AdFind and BloodHound for paths to Domain Admins |
| Lateral movement | T1210 Exploitation of Remote Services; T1021.002 SMB/Windows Admin Shares | EternalBlue, EternalRomance and Zerologon; Cobalt Strike Beacon dropped over SMB to domain controllers |
| Command and control | T1071.001 Web Protocols; T1571 Non-Standard Port; T1219 Remote Access Tools | HTTPS C2, HTTP on ports 447 and 8082 in some samples, VNC module for hands-on control |
| Firmware | T1495 Firmware Corruption; T1542.003 Bootkit | The "Trickboot" module can write or erase UEFI/BIOS firmware |
| Exfiltration | T1567.002 Exfiltration to Cloud Storage | Stolen data sent to cloud storage before encryption |
Microsoft documented one shipping-themed TrickBot campaign in which operators had control of the device and were running reconnaissance, credential theft and lateral movement within 8.5 hours of the macro executing. Plan detection and containment for hours, not days.
How they abuse identities and credentials
Almost every stage of a Wizard Spider intrusion turns on a credential. That makes identity hygiene a primary control, not a supporting one.
- Machine and application secrets on endpoints: PuTTY sessions in the registry, saved SSH keys, VPN profiles and FTP client passwords are the non-human credentials TrickBot harvests first. Move them into a vault and remove saved sessions from user workstations. See the Infostealer Threat Guide.
- Service accounts: Kerberoasting targets accounts with SPNs and old passwords. Use group managed service accounts where possible and long random passwords elsewhere. See the Kerberoasting and AS-REP Roasting Defence Guide.
- Local administrator reuse: pass the hash works when local admin passwords are shared. Microsoft recommends randomising them with LAPS.
- Domain Admin exposure: Microsoft advises reviewing Event ID 4624 logon types 2, 4, 5 and 10 for highly privileged accounts and keeping Domain Admins off member servers and workstations. See the Privileged Access Management Guide.
- Persistence accounts: ATT&CK records the group creating local administrator accounts and new domain accounts (T1136.001, T1136.002). Alert on account creation outside your provisioning system.
- Remote access credentials: stolen VPN logins (T1133) bypass the email layer entirely. Require phishing-resistant MFA on VPN and RDP gateways.
Disruption, sanctions and indictments
| Date | Action | Source |
|---|---|---|
| September 2020 | US Cyber Command disrupts TrickBot operations | IBM X-Force |
| 12 October 2020 | US District Court (Eastern District of Virginia) order lets Microsoft and partners disable TrickBot C2 IP addresses; first use of copyright claims over malicious use of Microsoft code; co-plaintiff FS-ISAC with ESET, Lumen Black Lotus Labs, NTT and Symantec | Microsoft |
| February 2021 | Arrest of a TrickBot developer | IBM X-Force |
| 9 February 2023 | US and UK sanction seven individuals linked to Trickbot; the UK's first sanctions of this kind | US Treasury |
| 7 September 2023 | US and UK sanction eleven more individuals in roles from administration and testing to HR and infrastructure purchasing; nine DOJ indictments covering Trickbot and Conti | US Treasury |
| 27 to 29 May 2024 | Operation Endgame, coordinated by Europol, targets droppers including IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot; over 100 servers taken down and four arrests | Europol |
The lesson from this sequence is that takedowns buy time rather than end an ecosystem: X-Force found the gang had rebuilt and was expanding distribution within a year of the 2020 actions. Sanctions also affect incident response, because ransom payments to designated persons can breach sanctions law. See the Cybercrime Law Enforcement Takedowns Guide and the Cybercrime Ecosystem Guide.
Detection and defence
Detect the loader and the credential theft, because by the time ransomware runs the useful window has closed. The approaches below are listed in the order an intrusion unfolds.
| Signal | Telemetry | Why it matters |
|---|---|---|
| Office or a script host (wscript.exe, mshta.exe) spawning PowerShell or cmd.exe | Process creation (Windows 4688 with command line, Sysmon 1, EDR) | The macro and JavaScript delivery seen in CISA and Microsoft reporting |
| New scheduled task or service pointing to AppData or ProgramData | Event 4698 (task created), 7045 (service installed) | TrickBot and Bazar persistence |
| Unexpected child processes or network connections from svchost.exe instances | EDR process tree and network events | Process hollowing into svchost.exe |
| Non-browser processes reading browser credential stores or PuTTY registry keys | EDR file and registry access, Sysmon 13 | Credential harvesting modules |
| WDigest UseLogonCredential set to 1 | Registry monitoring | Prepares for cleartext credential theft |
| Kerberos service tickets requested with RC4 encryption in bursts | Event 4769 on domain controllers | Kerberoasting before Domain Admin access |
| AdFind, Nltest trust queries or BloodHound collection from a workstation | Process creation, LDAP query volume | Path finding that precedes lateral movement |
| HTTP on ports 447 or 8082, or a "WinHTTP loader" user agent | Proxy and firewall logs, IDS | TrickBot C2 patterns named by CISA and ATT&CK |
Prevention controls that map to this tradecraft:
- Block macros and scripts from the internet: Microsoft's ransomware guidance lists attack surface reduction rules that block Office applications from creating child processes and block JavaScript or VBScript from launching downloaded executables. See the Macro Malware Guide.
- Allowlist signed scripts: CISA recommends application allowlisting that permits only authorised, digitally signed scripts. See the Application Allowlisting Guide.
- Protect LSASS and remove SMBv1: block credential theft from LSASS and disable SMBv1, as Microsoft and CISA respectively advise. See the SMB Protocol Security and Signing Guide.
- Segment and restrict admin paths: limit workstation to workstation SMB and RDP, and block PsExec and WMI process creation where not needed.
- Turn on tamper protection: the group disables security tools (T1685), so EDR tamper protection and alerts on agent health are essential.
- Keep firmware protected: Trickboot targeted UEFI, so enable Secure Boot, keep firmware current and include firmware integrity in investigations. See the Firmware and Boot Security Guide.
Implementation sequence:
- Inventory exposure first: internet-facing RDP, VPNs without MFA, SMBv1 hosts and accounts with SPNs.
- Pilot macro and script attack surface reduction rules in audit mode on one business unit for two weeks, review the hits, then enforce. Roll back by switching the rule to audit, not by disabling it.
- Deploy LAPS and remove Domain Admins from workstation logons, starting with IT staff devices.
- Build the detections above in your SIEM, test them in an authorised purple team exercise, and tune.
- Write an incident rule: any TrickBot, Bazar, Emotet or QakBot detection triggers a full compromise assessment and credential reset for the user and host, not just a reimage.
Decision guidance: small organisations without a SOC get most value from blocking macros from the internet, MFA on remote access, LAPS and a managed detection service. Large enterprises should add Kerberos and LDAP analytics on domain controllers and hunt for SystemBC-style SOCKS tunnels from servers. See the Threat Hunting Guide.
Metrics: median time from loader alert to host isolation; percentage of loader alerts that trigger a credential reset; number of service accounts with SPNs and passwords older than one year; percentage of privileged accounts logging on to workstations; share of endpoints with macro blocking enforced; count of hosts with SMBv1 enabled.
Framework mapping
| Defence | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | CIS Controls v8.1 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|---|
| Email and macro controls | SI-8, SI-3 | PR.PS-05 | Control 9 Email and Web Browser Protections | A.8.7 |
| Endpoint detection and tamper protection | SI-3, SI-4 | DE.CM-01 | Control 10 Malware Defenses | A.8.7, A.8.16 |
| Least privilege and admin tiering | AC-6 | PR.AA-05 | Control 5 Account Management, Control 6 Access Control Management | A.8.2 |
| MFA on remote access | IA-2 | PR.AA-05 | Control 6 Access Control Management | A.8.5 |
| Segmentation and SMB restrictions | SC-7, CM-7 | PR.PS-05 | Control 12 Network Infrastructure Management | A.8.22 |
| Patching (EternalBlue, Zerologon) | SI-2 | ID.RA-03 | Control 7 Continuous Vulnerability Management | A.8.8 |
| Threat intelligence and response | IR-4 | DE.AE-02, RS.MA-01 | Control 17 Incident Response Management | A.5.7, A.5.26 |
Common failure patterns
- Reimaging and moving on: treating a TrickBot or Bazar detection as commodity malware, as Microsoft warned, leaves persistence and stolen credentials in place for the ransomware stage.
- Merging aliases blindly: combining FIN12, DEV-0237 and DEV-0193 intelligence without checking which activity each vendor meant inflates or distorts your picture of the threat.
- Forgetting saved secrets: resetting the user's domain password but not the SSH keys, VPN profiles and application passwords TrickBot harvested.
- Ignoring the firmware layer: rebuilding the operating system on a host where firmware integrity was never checked.
- Relying on the takedown: assuming infrastructure disruptions in 2020 or 2024 removed the threat, when the operators and their successors kept working.
Practitioner checklist
- Map your detections to the G0102 and S0266 technique sets and record coverage gaps.
- Block macros and script execution from internet-sourced files on all endpoints.
- Require phishing-resistant MFA on VPN, RDP gateways and remote management tools.
- Deploy LAPS and stop privileged domain accounts logging on to workstations.
- Rotate service account passwords and move to group managed service accounts where possible.
- Remove saved SSH, PuTTY, VPN and FTP credentials from user endpoints.
- Disable SMBv1 and restrict workstation to workstation SMB and RDP.
- Alert on Kerberoasting patterns, AdFind and BloodHound use, and new services and scheduled tasks.
- Treat every loader detection as a possible precursor to ransomware, with a credential reset step.
- Check sanctions exposure in your ransomware response plan before any payment discussion.
Standards and references
- MITRE ATT&CK: Wizard Spider (G0102)
- MITRE ATT&CK: TrickBot (S0266)
- CISA: Alert AA21-076A, TrickBot Malware
- US Treasury: Additional Trickbot sanctions with the United Kingdom (September 2023)
- US Treasury: United States and United Kingdom sanction members of Russia-based Trickbot cybercrime gang
- Microsoft Security: Trickbot disrupted
- Microsoft Security: Ransomware as a service, understanding the cybercrime gig economy
- IBM X-Force: TrickBot gang doubles down on enterprise infection
Related NHI Mgmt Group resources: Conti Ransomware Profile Guide · Emotet Malware Guide · Cybercrime Ecosystem Guide · Malware Loaders and Droppers Guide · Ransomware Groups Guide